Create System User in AEM

AEM 6.1 comes with lot of features, one of those is allowing developer or content authors to create system user from CRX explorer. I have updated this post for creating system user in AEM 6.3 and how to package system user and its permissions, so that it can be easily deployed on any instance like dev,qa or prod.

The focus of this tutorial is to have a clear understanding about:

System User In AEM:-

Till AEM 6 we have the liberty to use any user as service user, for invoking and executing any service. But from AEM 6.1 there was a slight change on how to define the ServiceUserMapping and how the service user or system user has to be created.

If we try to assign any arbitrary user as service user in AEM 6.1 we would face below error : Cannot derive user name for bundle ch.inside.cqblog-bundleĀ [452] and sub serviceĀ readService

Note:- From AEM 6.1 service users can only be mapped to system users (jcr:primaryType = rep:SystemUser).

Why System User are Introduced:-

Use of admin session and admin resource resolver through ResourceresolverFactory is now deprecated, that’s why from AEM 6.1 Adobe forces developers to create system users and map them to Service User Mapper in Felix Console.

  • Prevent excessiveĀ use of administrative JCR Sessions andĀ ResourceResolvers.
  • Allow services access to ResourceResolvers and JCR Sessions without requiring to hard-code or configure passwords.
  • Allow services to use service users and/or system user which areĀ specially configured for service level access.

Create System User in AEM:-

A system user can either be created by definition in your application content package or manual creation in the CRX Explorer through ā€œUser Administrationā€. As this is a system user, no need to set a password.

  • Go to CRX Explorer.
  • Click on User Administration.
  • Click on Create system User from Top Bar.
    • Ā UserId- testSystemUser (User Id of system user you want to assign)
    • Intermediate Path – /home/users/systemNote:- Path where you want to store system user. If no path is provided it will store user at some arbitrary node. This field is optional, but it is always advisable to provide path so that it will be easy to track user.


  • Click on Green check box.
  • Your system user is successfully created.
  • You can also view system user details from CRX DE at this pathĀ /home/user/system.

Define Service User Mapper in AEM :-

For definingĀ a service user mapper, a new configuration can be created usingĀ Apache sling Service User Mapper Service Amendment.

  • Go to Felix Console configurations.
  • Search for “service user mapper” configuration.
  • Click on Plus sign against Apache sling Service User Mapper Service AmendmentĀ to create new factory configuration.
  • Enter Service Mapping Details
    • Enter entry in form of BundleId:subserviceName=userName.


  • For example in below screenshot:
    • bundleId = com.adobe.cq.cq-dms-tagmanager
    • subServiceNameĀ =tagmanagement
    • systemUser Name =tagmanagerservice


For example in our case, we want to addĀ testSystemUser system user mapping inĀ Apache sling Service User Mapper Service Amendment. Follow below steps to add entry into service user mapper service in aem:-

Lets Assume below details:-

  • bundleId = com.aemlearning (You can find your bundle symbolic name under your core pom.xml )
  • subServiceNameĀ = testSystemUser (Used in your java for getting resource resolver based on subService Name)
  • systemUser Name = testSystemUser (Your system user Name, that you have given at time of creation of system user)


How to package system user using acs commons acl packager:-

In aem, if we have to export users or groups from one environment to another we use packages. To transfer permissions along with user we use acs commons acl packager.

As a pre-requisite lets first add permission to ourĀ testSystemUser. Lets consider we want this system user for content editing usage.

  • Navigate to User Admin Console.
  • Search for your user (testSystemUser).
  • Select your user and go to Permissions Tab.
  • Provide full access to /content folder. By selecting all check box against content row. You can ignore replicate checkbox as we don’t want this user for replication.
  • Click on save.


Follow below steps to create ACS Commons ACL Packager:-

  • Log in to AEM Author.
  • Navigate to the Classic UI Tools Console (In case of Touch UI, You can navigate toĀ  Tools–>Operations –> ConfigurationĀ )
  • Under the acs-commons folder, create a folder named packagers.Ā (name should be packagers, Title you can keep according to your choice, If you keep any other folder name apart from packagers then no template will be displayed).
    NOTE: As of acs commons version 1.6.0, this folder is created automatically
  • Under the packagers folder, create a new Page of Template type ā€œACL Packagerā€


  • Double click on newly created page.
  • Click Edit.
  • Enter values in dialog to configure the package rules and configuration.
    • Add Principal Names:-Ā Add names of user that you want to export.
    • Include Patterns:- Add path from which you want to add rep:Policy or permissions


  • Click OK , It will display a brief overview of your ACL Package.
  • Click On Preview button output a list of the access control entries which will be packaged.
  • Click on Create Package. That’s it you are done. You have successfully created acl packager package for system user at /etc/packages/AEMCQ5Tutorials/Package System . Navigate to crx package manager build and download your package. You can now import it on any environment where ever you want.
    Note:- Once you have create a package you cannot change, package configuration. For changing package configuration you need to create a new acl package.


Spread the love

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.